Detect Attacks with Sysmon

[kleox]

Where was the file downloaded by the victim (C:*******)
I think that’s the answer to this question, what am I doing wrong?

[yorusec]

the attacker got a shell with that file you entered and then download a file to pr******** es******** ?

[kleox]

i got it, thanks for advice.